Fix Unrestricted Resource Consumption in Gatsby
Gatsby Functions and SSR routes are prime targets for Unrestricted Resource Consumption (CWE-400). Without strict bounds on input size, execution time, and request frequency, an attacker can trigger a Denial of Service (DoS) or blow through your serverless budget. We are talking about memory exhaustion via massive payloads and CPU spikes from un-throttled expensive operations.
The Vulnerable Pattern
export default async function handler(req, res) { // VULNERABILITY: No body size limit and no rate limiting const { data } = req.body;// Expensive operation simulating heavy CPU/Memory usage const processed = data.map(item => ({ …item, hash: someExpensiveHash(item) }));
res.status(200).json({ success: true, count: processed.length }); }
The Secure Implementation
To harden Gatsby Functions, you must implement a multi-layered defense. First, enforce a Content-Length check to drop massive payloads before they hit your logic. Second, integrate a rate-limiting mechanism (like lambda-rate-limiter or Redis-backed stores) to prevent brute-force resource exhaustion. Third, strictly validate the shape and size of the input data (e.g., limiting array lengths) to ensure the complexity of operations remains O(n) within safe bounds. Finally, offload heavy processing to background workers rather than blocking the main execution thread.
import rateLimit from 'lambda-rate-limiter';const limiter = rateLimit({ interval: 60 * 1000, uniqueTokenPerInterval: 500, });
export default async function handler(req, res) { try { // 1. Rate Limiting: Max 10 reqs per minute per IP await limiter.check(res, 10, ‘USER_IP’);
// 2. Payload Size Validation const contentLength = req.headers['content-length']; if (contentLength && parseInt(contentLength) > 1024 * 100) { return res.status(413).json({ error: 'Payload too large (Max 100KB)' }); } // 3. Input Validation const { data } = req.body; if (!Array.isArray(data) || data.length > 50) { return res.status(400).json({ error: 'Invalid data or batch size too large' }); } res.status(200).json({ success: true });
} catch (err) { res.status(429).json({ error: ‘Rate limit exceeded’ }); } }
Your Gatsby API
might be exposed to Unrestricted Resource Consumption
74% of Gatsby apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.